Эксплуатируемые и новые серьёзные CVE: октябрь 2026 г.

Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially exe

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Use after free in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox vi

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTM

• Без аутентификации
• Утечка информации

google · chrome6 окт. 2026 г.

Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potent

• RCE без входа
• Состояние гонки

google · chrome6 окт. 2026 г.

Integer overflow in WebGL in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary c

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr

• RCE без входа

google · chrome6 окт. 2026 г.

Incorrect authorization in Search in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineer

• RCE без входа
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Buffer overflow in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to poten

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Use after free in Bindings in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox vi

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Incorrect authorization in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive info

• Без аутентификации
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside

• RCE без входа

google · chrome6 окт. 2026 г.

Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sand

• RCE без входа
• Состояние гонки

google · chrome6 окт. 2026 г.

Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering

• Без аутентификации
• Утечка информации

google · chrome6 окт. 2026 г.

Use after free in HTML in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a c

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Missing authorization in Workers in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process

• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engi

• Без аутентификации

google · chrome6 окт. 2026 г.

Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to execute arbitrar

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Incorrect reference resolution in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker who had compromised t

• RCE

google · chrome6 окт. 2026 г.

Use after free in Tint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the s

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially e

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Use after free in GarbageCollection in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the s

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Buffer overflow in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to poten

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Type confusion in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potent

• RCE без входа

google · chrome6 окт. 2026 г.

Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restric

• Без аутентификации

google · chrome6 окт. 2026 г.

Use after free in Chrome Tabs in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary c

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer proce

• Без аутентификации

google · chrome6 окт. 2026 г.

Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social

• Без аутентификации

google · chrome6 окт. 2026 г.

Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive informa

• Без аутентификации
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Incorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a

• Без аутентификации
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Use after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sand

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engine

• RCE без входа
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to pot

• RCE без входа
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensi

• Без аутентификации
• Утечка информации

google · chrome6 окт. 2026 г.

Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sand

• RCE без входа

google · chrome6 окт. 2026 г.

Information leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted

• Без аутентификации
• Утечка информации

google · chrome6 окт. 2026 г.

Improper state validation in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary cod

• RCE без входа

google · chrome6 окт. 2026 г.

Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Use after free in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a c

• Без аутентификации
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obt

• Без аутентификации
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer proce

• Без аутентификации
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering

• RCE
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Incorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain s

• Без аутентификации
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outsid

• RCE без входа
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Use after free in Fonts in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr

• RCE без входа

google · chrome6 окт. 2026 г.

Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside t

• RCE без входа

google · chrome6 окт. 2026 г.

Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execut

• RCE без входа
• Состояние гонки

google · chrome6 окт. 2026 г.

Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer

• RCE без входа

google · chrome6 окт. 2026 г.

Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to

• Без аутентификации
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to exec

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Incorrect authorization in Accessibility in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer

• Без аутентификации
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had comprom

• RCE без входа

google · chrome6 окт. 2026 г.

Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process

• RCE без входа
• Состояние гонки

google · chrome6 окт. 2026 г.

Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineerin

• RCE без входа

google · chrome6 окт. 2026 г.

Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside th

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside th

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a c

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the

• RCE без входа
• Состояние гонки

google · chrome6 окт. 2026 г.

Hydra: Mutable instantiate policy sets allow target blocklist bypass

• Локальное повышение привилегий

hydra-ecosystem · hydra6 окт. 2026 г.

Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method

• Локальное повышение привилегий

hydra-ecosystem · hydra6 окт. 2026 г.

Hydra logging configuration permits unsafe callable resolution

• RCE
• Локальное повышение привилегий

hydra-ecosystem · hydra6 окт. 2026 г.

Hydra instantiate target blacklist bypasses permit code execution

• Десериализация
• Локальное повышение привилегий

hydra-ecosystem · hydra6 окт. 2026 г.

WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE

• RCE

kozea · weasyprint6 окт. 2026 г.

MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract syst

• Без аутентификации
• Обход аутентификации

multiversx labs s.r.l. · multisig-improved6 окт. 2026 г.

MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS

• XSS

misp · sachertortephp6 окт. 2026 г.

In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code.

• RCE без входа
• Ошибки памяти

google · android6 окт. 2026 г.

In ep_free of eventpoll.c, there is a possible use-after-free due to a race condition.

• Локальное повышение привилегий
• Состояние гонки

google · android6 окт. 2026 г.

Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability.

• Слабая криптография

dell · system update6 окт. 2026 г.

Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vu

• Обход пути
• Локальное повышение привилегий

dell · system update6 окт. 2026 г.

Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain an Improper Handling of Mixed Encoding vulnerability.

• Без аутентификации

dell · command|configure6 окт. 2026 г.

Postgres-exporter: net/http/pprof exposed on metrics listener

• Без аутентификации

red hat · multicluster global hub6 окт. 2026 г.

Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vu

• RCE без входа
• Обход пути

dell · system update6 окт. 2026 г.

Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability.

• Локальное повышение привилегий

dell · system update6 окт. 2026 г.

Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability.

• Локальное повышение привилегий
• Нарушение контроля доступа (IDOR)

dell · system update6 окт. 2026 г.

Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts

• RCE
• SSRF

github · enterprise server6 окт. 2026 г.

Gitea migration SSRF through ALLOWED_DOMAINS address check bypass

• SSRF

gitea · gitea6 окт. 2026 г.

Security Advisory 0187

• Без аутентификации
• Открытый редирект

arista networks · cloudvision portal6 окт. 2026 г.

Security Advisory 0188

• Обход пути

arista networks · cloudvision portal6 окт. 2026 г.

Security Advisory 0189

• Обход пути

arista networks · cloudvision portal6 окт. 2026 г.

Security Advisory 0189

• Обход пути

arista networks · cloudvision portal6 окт. 2026 г.

Security Advisory 0192

• Без аутентификации
• XSS

arista networks · cloudvision cue6 окт. 2026 г.

Security Advisory 0185

• XSS

arista networks · cloudvision portal6 окт. 2026 г.

Security Advisory 0190

• XXE

arista networks · cloudvision cue6 окт. 2026 г.

Security Advisory 0190

• SQL-инъекция

arista networks · cloudvision cue6 окт. 2026 г.

Security Advisory 0190

• Без аутентификации
• Обход аутентификации

arista networks · cloudvision cue6 окт. 2026 г.

Security Advisory 0190

• RCE
• Инъекция команд

arista networks · cloudvision cue6 окт. 2026 г.

Security Advisory 0190

• Без аутентификации
• Обход аутентификации

arista networks · cloudvision cue6 окт. 2026 г.

Security Advisory 0193

• RCE без входа
• Ошибки памяти

arista networks · wi-fi access points6 окт. 2026 г.